Junos Basics – Securing J-Web Access On Juniper EX Series Switches

In my previous Junos Basics post I covered automatic configuration archiving. In this post we’ll step through a solution to prevent unauthorised access to the J-Web GUI on EX Series switches. This solution could be modified to also restrict access on other management ports such as SSH and SNMP.

First of all we need to define our list of hosts that are allowed to access the switch via J-Web:

first, accepts connections on any service from addresses on the NetManagement prefix list

then, discards all other HTTPS traffic

finally, accepts all other traffic

Here’s the code for this:

set firewall family inet filter J-Web term AllowedIPAnyService from source-prefix-list NetManagement
set firewall family inet filter J-Web term AllowedIPAnyService then accept
set firewall family inet filter J-Web term BlockOtherHTTPS from destination-port https
set firewall family inet filter J-Web term BlockOtherHTTPS then discard
set firewall family inet filter J-Web term default then accept

Finally, apply the filter inbound to the loopback 0 interface (if you apply a firewall filter inbound on the loopback of a Juniper device, this will be applied to all traffic processed by the routing-engine. This includes traffic with a destination address of a physical interface (i.e. not the loopback):

About Rich Bibby

Rich Bibby is a UK based Network Engineer, working mainly with Cisco, Juniper and Arista gear in the enterprise LAN, WAN and Data Centre space. Aside from route/switch/firewalling, he is interested in open source network monitoring and management tools, and exploring the possibilities that automation and programmability bring to networking.
Follow Rich on Twitter

I didn’t :-(I just edit my hosts file manually once in a while. It doesn’t raelly break anything unless you connect from a network that has an unreachable IP for the VPN machine (for example, internal network then internet).It’s just messy